Robokassa Payment Gateway CVE-2026-91076

No special configuration is required beyond having the Robokassa payment gateway for WooCommerce plugin (version before 1.9.0) installed and active with its payment-notification/callback endpoint reachable - the default deployment for any shop using this gateway. The core precondition is that the plugin processes the incoming notification without validating its authenticity (no signature verification), so any remote unauthenticated party can submit a request. Exploitation is further enabled by sequential, predictable order identifiers, allowing enumeration of every order. Limiting factors: impact is confined to forcing orders into a failed/non-fulfilment state (an integrity/business-logic disruption), not data disclosure, code execution, or server availability; sites on 1.9.0 or later, or not using this specific gateway, are unaffected.

This is a genuine but limited-impact issue best treated as a moderate, not top-tier, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms a remote, unauthenticated, low-complexity attack requiring no user interaction, and the PR:N component means authentication is genuinely not required. However, impact is narrow: only I:L (integrity) with C:N and A:N, reflecting that an attacker can corrupt order fulfilment state but cannot read data, execute code, or take the site down at the server level. The EPSS score is low (0.17%, 5th percentile), indicating little evidence of broad opportunistic exploitation, which is consistent with the absence of a CISA KEV listing - there is NO confirmed active exploitation. Publicly available exploit code exists (via WPScan), so the barrier to weaponization is low, but POC availability is distinct from active exploitation and should not be conflated. No SSVC decision data was provided in the input. The signals are internally consistent rather than conflicting: a real, easily-triggered flaw whose low CVSS and low EPSS correctly reflect limited blast radius (business-logic disruption of a niche plugin) rather than mass-exploitable server compromise. Note the CWE (CWE-862, Missing Authorization) describes a missing authenticity/authorization check on the callback, which aligns with the description better than the input 'Authentication Bypass' tag.

An attacker who knows the shop's public Robokassa notification endpoint sends a forged payment-notification request naming a target order; because the plugin does not verify the request's authenticity (no signature/HMAC validation), it acts on the named order and marks it failed. Since order IDs are sequential, the attacker scripts requests across the ID range to pull every order out of the fulfilment queue. Publicly available exploit code (WPScan) lowers the effort required to reproduce this.